PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CodeBreach: Infiltrating the AWS Console Supply Chain and Hijacking AWS GitHub Repositories via CodeBuild

wiz.io | blog | #cloud | #supply-chain | #aws | #github | #ci-cd | #vulnerability | #wiz-research | #codebuild
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

CodeBreach: two missing regex characters in AWS CodeBuild pipelines let unauthenticated attackers leak credentials and take over key AWS GitHub repos, including the Console's JavaScript SDK.
Published
Collected

Related coverage

blog · wiz.io
LiteLLM Compromised, Steals Credentials
# LiteLLM Compromised, Steals Credentials In a new incident, a malicious version (1.107.0) of the LiteLLM package was uploaded to PyPI and Docker on October 21. The malicious version includes a...
blog · wiz.io
2025 State of Code Security: Key Trends and Risks
Wiz's 2025 State of Code Security report: 35% of GitHub repos are public, 61% of organizations have cloud secrets exposed in public repos, and self-hosted CI/CD runners raise lateral-movement risk.
blog · metabase.com
More, Better, Faster: How we automate Metabase releases
How we went from a manual Metabase release checklist to fully automated daily patch releases with GitHub Actions, reused test builds, and a three-click release UI
research · wiz.io
The Blue Agent POV: Investigating Multi-Platform Data Exfiltration Across AWS and GitHub
Wiz's Blue Agent walks through investigating a multi-platform data exfiltration campaign spanning AWS, S3 and GitHub, showing how the agent gathers evidence and reconstructs the full attack chain in minutes instead of hours.
research · wiz.io
Exposure Report: 65% of Leading AI Companies Found with Verified Secret Leaks
Wiz scanned the Forbes AI 50 and found 65% of leading private AI companies had verified secret leaks on GitHub — API keys and tokens buried in deleted forks and gists that standard scanners miss.
vulnerability · about.gitlab.com
Pillow CVE-2026-112900: How to find and fix it with GitLab
Upgrade to Pillow 13.0.0, then use dependency scanning, code search, and GitLab Duo Agent Platform to patch every affected Python project in your groups.
Back